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Chemical  Facility  Security:  Regulation  and  Issues  for 

Congress 


Summary 

On  April  9,  2007,  the  Department  of  Homeland  Security  (DHS)  issued  an 
interim  final  rule  (72  Federal  Register  17688-17745  (April  9,  2007))  on  chemical 
facility  security,  implementing  the  statutory  authority  granted  in  the  Homeland 
Security  Appropriations  Act,  2007  (P.L.  109-295,  Section  550).  The  regulations 
require  chemical  facilities  possessing  amounts  and  types  of  substances  considered  by 
the  DHS  Secretary  to  be  hazardous  to  notify  DHS  and  undergo  a  consequence-based 
screening  process.  The  Secretary  then  determines  which  chemical  facilities  are  high- 
risk,  and  thus  need  to  comply  with  additional  security  requirements.  High-risk 
facilities  are  to  be  categorized  into  tiers  based  on  risk,  and  those  with  higher  risk 
must  comply  with  more  stringent,  performance-based  security  requirements. 

Under  the  interim  final  rule,  high-risk  chemical  facilities  are  required  to  create 
and  submit  to  DHS  a  vulnerability  assessment;  create  and  submit  to  DHS  a  site 
security  plan,  addressing  the  vulnerability  assessment  and  complying  with  the 
performance-based  standards;  and  implement  the  site  security  plan  at  the  chemical 
facility.  The  DHS  Secretary  is  to  approve  or  disapprove  each  step  in  the  process,  and 
may  require  the  chemical  facility  to  improve  the  submission  or  implementation. 

The  interim  final  rule  establishes  a  new  category  of  protected  information, 
Chemical-terrorism  Vulnerability  Information  (CVI),  granting  it  a  status  between 
sensitive  but  unclassified  and  classified  information.  The  Secretary  maintains 
discretion  over  who  will  gain  access  to  this  information,  how  it  may  be  used,  and 
what  will  comprise  CVI.  Additionally,  the  interim  final  rule  may  preempt  future 
state  and  local  chemical  facility  security  regulations. 

Key  issues  debated  in  previous  Congresses  are  highlighted  in  the  issued  security 
regulations,  even  where  the  enacted  authorizing  statute  remained  mute  on  the  topic. 
These  issues  include  what  facilities  should  be  considered  as  chemical  facilities; 
which  chemical  facilities  should  be  considered  as  “high-risk”  and  thus  regulated;  the 
scope  of  the  risk-based  performance  standards  for  different  tiers  of  high-risk 
chemical  facilities;  the  appropriateness  of  federal  preemption  of  existing  state 
chemical  facility  security  regulation;  and  the  availability  of  information  for  public 
comment,  potential  litigation,  and  congressional  oversight.  One  key  issue  not 
directly  addressed  by  the  regulation  is  the  role  of  inherently  safer  technology  in  the 
chemical  security  process. 

Congress  may  take  further  action.  Since  the  statutory  authority  to  regulate 
chemical  facilities  expires  in  2009,  policymakers  may  choose  to  observe  the  impact 
of  the  current  regulations  and,  if  necessary,  address  any  perceived  weaknesses  at  a 
later  date.  Congress  might  disapprove  the  interim  final  rule  or  attempt  to  influence 
its  implementation  through  oversight  or  provisions  in  appropriations  language. 
Alternatively,  Congress  may  decide  that  additional  legislation  is  required.  Three 
authorizing  bills  (H.R.  1530,  H.R.  1574,  andH.R.  1633)  on  chemical  facility  security 
have  been  introduced  in  the  House,  and  chemical  facility  security  language  has  been 
attached  to  appropriations  bills  (H.R.  2638  and  S.  1644). 
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Chemical  Facility  Security:  Regulation  and 
Issues  for  Congress 


Introduction 

Chemical  facility  security  has  been  an  issue  of  congressional  interest  for  many 
years.  First  considered  an  environmental  issue,  the  potential  for  release  of  toxic 
chemicals  and  the  associated  potential  health  impacts  on  surrounding  areas  became 
linked  to  concerns  over  terrorism  after  the  September  11,  2001  attacks.  The  passage 
of  Section  550  of  the  Homeland  Security  Appropriation  Act,  2007  (P.L.  109-295) 
established  statutory  authority  for  the  Department  of  Homeland  Security  (DHS)  to 
regulate  security  at  select  chemical  facilities.1  How  DHS  implements  this  authority 
will  likely  be  an  area  of  intense  congressional  interest,  given  that  chemical  facility 
security  legislation  was  introduced  in  each  of  the  previous  four  Congresses  and  that 
this  new  statutory  authority  expires  three  years  after  enactment.2 

Chemical  facility  security  authority  had  been  called  for  by  both  the  Executive 
and  Legislative  branches  for  many  years,  but  disagreements  about  how  chemical 
facilities  should  be  regulated  impeded  consensus.  The  potential  for  injuries  and 
fatalities  following  an  attack  on  a  chemical  facility,  as  well  the  value  of  the  chemical 
sector  to  the  national  economy,  led  many  security  experts  to  suggest  that  chemical 
facilities  are  high-value  targets  for  terrorists.  Securing  chemical  facilities  is 
considered  a  key  component  of  protecting  the  nation’s  critical  infrastructure. 
Enactment  of  P.L.  109-295  and  promulgation  of  the  interim  final  rule  were  seen  as 
important  steps  in  securing  chemical  facilities;  however,  any  increase  in  homeland 
security  will  depend  on  their  effective  implementation. 

This  report  describes  the  statutory  authority  granted  to  DHS  and  the  interim  final 
rule  promulgated  by  DHS,  and  identifies  select  issues  of  contention  related  to  the 
interim  final  rule.  Finally,  this  report  discusses  several  possible  policy  options  for 
Congress. 


1  Department  of  Homeland  Security  Appropriations  Act,  2007,  P.L.  109-295  §  550, 120  Stat. 
1355  (2006)  [hereinafter  DHS  Appropriations  Act],  See  also  71  Federal  Register  78276- 
78332  (December  28,  2006)  and  72  Federal  Register  17688-17745  (April  9,  2007). 

2  See  CRS  Report  RL31530,  Chemical  Facility  Security,  by  Linda-Jo  Schierow  (providing 
background  on  the  need  for  additional  security  measures,  security  enhancement  options,  and 
legislation  in  the  109th  Congress). 
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Authority  to  Regulate  Chemical  Facilities 

The  Homeland  Security  Appropriations  Act,  2007  (P.L.  109-295),  Section  550 
provides  statutory  authority  to  DHS  to  regulate  chemical  facilities  for  security 
purposes.  The  Secretary  of  Homeland  Security  is  directed  to  issue  interim  final 
regulations  establishing  risk-based  performance  standards  for  chemical  facility 
security,  and  requiring  the  development  of  vulnerability  assessments  and  the 
development  and  implementation  of  site  security  plans.3  These  regulations  are  to 
apply  only  to  those  chemical  facilities  that  the  Secretary  determines  present  high 
levels  of  security  risk.4  The  regulations  are  to  allow  regulated  entities  to  employ 
combinations  of  security  measures  to  meet  the  risk-based  performance  standards.5 

Under  the  law,  the  Secretary  must  review  and  approve  the  required  assessment, 
plan,  and  implementation  for  each  facility.  The  Secretary  is  prohibited  from 
disapproving  a  site  security  plan  on  the  basis  of  the  presence  or  absence  of  a 
particular  security  measure,  but  may  disapprove  a  site  security  plan  that  does  not 
meet  the  risk-based  performance  standards.  The  Secretary  may  approve  vulnerability 
assessments  and  site  security  plans  developed  through  security  programs  not  created 
by  DHS,  so  long  as  the  results  of  these  programs  meet  the  risk-based  performance 
standards  laid  out  in  regulation. 

All  information  developed  for  these  regulations  is  to  be  protected  from  public 
disclosure,  but  may  be  shared,  at  the  Secretary’s  discretion,  with  state  and  local 
government  officials,  including  law  enforcement  officials  and  first  responders 
possessing  the  necessary  security  clearances.  Such  shared  information  may  not  be 
publicly  disclosed  regardless  of  state  or  local  laws.  Additionally,  the  information 
provided  to  the  Secretary,  along  with  related  vulnerability  information,  is  to  be 
treated  as  classified  information  in  all  judicial  and  administrative  proceedings. 
Violation  of  the  information  protection  provision  is  punishable  by  fine. 


3  These  interim  final  regulations  must  be  issued  within  six  months  of  the  date  of  enactment 
of  P.L.  109-295.  The  statutory  deadline  for  the  interim  final  regulations  was  April  4,  2007. 

4  Some  facilities  are  exempt  from  these  regulations.  They  are  facilities  defined  as  a  water 
system  or  a  wastewater  treatment  works;  facilities  owned  or  operated  by  the  Department  of 
Defense  or  Department  of  Energy;  facilities  regulated  by  the  Nuclear  Regulatory 
Commission;  and  those  facilities  regulated  under  the  Maritime  Transportation  Security  Act 
of  2002  (P.L.  107-295). 

5  According  to  the  Office  of  Management  and  B  udget,  a  performance  standard  is  “a  standard 
as  defined  above  that  states  requirements  in  terms  of  required  results  with  criteria  for 
verifying  compliance  but  without  stating  the  methods  for  achieving  required  results.  A 
performance  standard  may  define  the  functional  requirements  for  the  item,  operational 
requirements,  and/or  interface  and  interchangeability  characteristics.  A  performance 
standard  may  be  viewed  in  j  uxtaposition  to  a  prescriptive  standard  which  may  specify  design 
requirements,  such  as  materials  to  be  used,  how  a  requirement  is  to  be  achieved,  or  how  an 
item  is  to  be  fabricated  or  constructed.”  Office  of  Management  and  Budget,  “Federal 
Participation  in  the  Development  and  Use  of  Voluntary  Consensus  Standards  and  in 
Conformity  Assessment  Activities,”  Circular  A- 119,  February  10,  1998. 
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The  Secretary  must  audit  and  inspect  chemical  facilities  and  determine 
regulatory  compliance.  If  the  Secretary  finds  a  facility  not  in  compliance,  the 
Secretary  shall  write  to  the  facility  explaining  the  deficiencies  found,  provide  an 
opportunity  for  the  facility  to  consult  with  the  Secretary,  and  issue  an  order  to  comply 
by  a  date  determined  by  the  Secretary.  If  the  facility  continues  to  be  out  of 
compliance,  the  Secretary  may  fine  and,  eventually,  order  the  facility  to  close. 

There  is  no  right  for  anyone,  except  the  Secretary  of  DHS,  to  bring  a  lawsuit 
against  a  facility  owner  to  enforce  provisions  of  the  law.  The  law  does  not  affect  any 
other  federal  law  regulating  chemicals  in  commerce.  The  statute  contains  a  “sunset 
provision”  and,  thus,  expires  on  October  4,  2009,  three  years  from  the  date  of 
enactment. 


Regulations  Issued  by  the  Department  of  Homeland 

Security 

On  April  9,  2007,  the  Department  of  Homeland  Security  issued  an  interim  final 
rule  regarding  chemical  facility  security.6  This  interim  final  rule,  implementing  P.L. 
109-295,  entered  into  force  on  June  8,  2007.  The  interim  final  rule  implements  both 
statutory  authority  explicit  in  P.L.  109-295  and  authorities  DHS  found  to  be 
implicitly  granted. 

The  interim  final  rule  states  that  the  Secretary  of  DHS  will  select  from  the 
universe  of  all  facilities  that  possess,  or  plan  to  possess  at  any  relevant  point  in  time, 
a  quantity  of  chemical  substance  determined  by  the  Secretary  to  be  potentially 
dangerous,  a  smaller  set  of  chemical  facilities  deemed  as  presenting  a  high  level  of 
security  risk.7  As  such,  chemical  facilities  with  greater  than  specified  quantities  of 
potentially  dangerous  chemicals  will  be  required  to  submit  information  to  DHS,  so 
that  DHS  can  determine  the  facility’s  risk  status. 

The  DHS  is  to  establish  a  series  of  risk-based  tiers  with  different  performance- 
based  requirements  for  facilities  assigned  to  each  tier.  Those  facilities  identified  by 
DHS  as  high  risk  will  have  additional  responsibilities.  All  high-risk  facilities  must 
assess  their  vulnerabilities,  using  methodology  accepted  by  DHS;  develop  an 
effective  security  plan;  submit  these  documents  to  DHS;  and  implement  the  security 
plan.  Vulnerability  assessments  and  site  security  plans  developed  through  alternative 
security  programs  will  be  accepted  so  long  as  they  meet  the  tiered,  performance- 
based  requirements  of  the  interim  final  rule.  In  turn,  DHS  will  approve  or  disapprove 
the  vulnerability  assessments,  the  site  security  plans,  and  their  implementation 


6  72  Federal  Register  17688-17745  (April  9,  2007).  This  interim  final  rule  followed  the 
release  of  an  advanced  notice  of  rulemaking.  See  71  Federal  Register  78276-78332 
(December  28,  2006). 

7  This  initial  screening  of  chemical  facilities  will  be  done  on  the  basis  of  potential 
consequence,  rather  than  risk.  72  Federal  Register  17688-17745  (April  9,  2007)  at  17700. 
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through  audit  and  inspection.  The  DHS  will  provide  certification  of  the  facility’s 
compliance  status.8 

The  vulnerability  assessment  will  serve  two  purposes  under  the  interim  final 
rule.  One  is  to  determine  or  confirm  the  placement  of  the  facility  in  a  risk-based  tier. 
The  other  is  to  provide  a  basis  against  which  to  compare  the  site  security  plan 
activities.  The  vulnerability  assessment  required  by  DHS  will  include  the  following 
components:  asset  characterization,  threat  assessment,  security  vulnerability  analysis, 
risk  assessment,  and  countermeasures  analysis.9 

The  site  security  plans  must  address  the  vulnerability  assessment  by  describing 
how  activities  in  the  plan  relate  to  facility  vulnerabilities.  Additionally,  the  site 
security  plan  must  address  preparations  for  and  deterrents  against  specific  modes  of 
potential  terrorist  attack,  as  applicable.  These  modes  of  attack  may  include  vehicle- 
borne  improvised  explosive  device;  water-borne  explosive  device;  ground  assault; 
or  other  modes  of  potential  attack  identified  by  DHS.10  The  site  security  plans  must 
also  address  how  the  activities  taken  by  the  facility  meet  the  risk-based  performance 
standards  provided  by  DHS. 

All  vulnerability  assessments  and  site  security  plans  are  to  be  submitted  to  DHS 
for  approval.  The  Secretary  may  disapprove  of  those  assessments  or  plans  that  fail 
to  meet  DHS  standards,  but  not  on  the  basis  of  the  presence  or  absence  of  a  specific 
measure.  In  the  case  of  disapproval,  DHS  must,  in  writing,  identify  those  areas  of  the 
assessment  and  plan  that  need  improvement.  Chemical  facilities  may  appeal 
disapprovals  to  DHS. 

The  information  generated  under  this  interim  final  rule,  as  well  as  any 
information  developed  for  chemical  facility  security  purposes  that  the  Secretary 
determines  needs  to  be  protected,  will  be  labeled  “Chemical-terrorism  Vulnerability 
Information”  (CVI),  a  new  category  of  security-related  information.  According  to  the 
interim  final  rule,  DHS  will  have  sole  discretion  regarding  who  will  be  eligible  to 
receive  CVI.11 

The  interim  final  rule  will  preempt  state  and  local  regulation  where  state  and 
local  regulation  “conflicts  with,  hinders,  poses  an  obstacle  to  or  frustrates  the 
purposes  of’  the  federal  regulation.12  States,  localities,  or  affected  companies  may 


8  Audit  inspections  may  be  conducted  by  third-party  auditors.  It  is  unclear  whether 
compliance  with  the  regulation  would  reduce  the  risk  status  of  the  chemical  facility,  since 
regulatory  compliance  would  presumably  decrease  the  vulnerability  of  the  facility  and 
vulnerability  is  a  factor  used  to  determine  risk  status.  The  DHS  plans  to  issue  a  future 
rulemaking  regarding  the  use  of  third-party  auditing.  72  Federal  Register  17688-17745 
(April  9,  2007)  at  17712. 

9  72  Federal  Register  17688-17745  (April  9,  2007)  at  17732. 

10  Id.  at  17732. 

11  Id.  at  17738. 

12  Id.  at  17739. 
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request  a  decision  from  DHS  regarding  potential  conflict  between  extant  regulation 
and  the  federal  regulation. 

The  interim  final  rule  establishes  penalties  for  the  disclosure  of  C  VI  information 
or  lack  of  compliance,  as  well  as  processes  for  appeal  by  chemical  facilities  of  DHS 
actions.  If  a  facility  remains  out  of  compliance  with  this  interim  final  rule,  DHS  may 
order  its  closure,  after  other  penalties,  such  as  fines,  have  been  levied. 


Key  Issues 

Chemical  facility  security  was  the  focus  of  several  congressional  hearings  and 
policy  debates  surrounding  proposed  legislation  in  the  109lh  Congress,  legislation 
reported  by  the  House  Homeland  Security  Committee  and  the  Senate  Committee  on 
Homeland  Security  and  Governmental  Affairs.  Some,  but  not  all,  of  the  topics  that 
were  considered  contentious  were  addressed  by  P.L.  109-295.  This  section  will 
discuss  several  of  these  topics  in  light  of  the  enacted  provisions:  the  scope  of  the 
regulated  facilities,  inherently  safer  technology,  federal  preemption,  and  the 
protection  of  information. 

Scope  of  Regulated  Facilities 

The  universe  of  regulated  facilities  is  not  specified  in  P.L.  109-295  and  thus 
remains  potentially  an  issue  of  policy  debate.  Under  the  interim  final  rule,  chemical 
facilities 

shall  mean  any  establishment  that  possesses  or  plans  to  possess,  at  any  relevant 
point  in  time,  a  quantity  of  a  chemical  substance  determined  by  the  Secretary  to 
be  potentially  dangerous  or  that  meets  other  risk-related  criteria  identified  by  the 
Department.13 

Regulated,  or  covered,  facilities  are  a  subset  of  the  chemical  facility  universe, 
including  any  chemical  facility  that  “presents  a  high  risk  of  significant  adverse 
consequences  for  human  life  or  health,  national  security  and/or  critical  economic 
assets  if  subjected  to  terrorist  attack,  compromise,  infiltration,  or  exploitation.”14 

The  chemical  substances  determined  by  the  Secretary  to  be  potentially 
dangerous  were  reported  with  the  interim  final  rule.  This  list,  promulgated  as 
Appendix  A,  is  not  final.  The  DHS  sought  public  comment  on  the  chemical  list,  and 
additional  rulemaking  is  to  finalize  this  list.  The  current  list  incorporates  chemicals 
from  the  Environmental  Protection  Agency’s  Risk  Management  Program  list,  the 
Chemical  Weapons  Convention  schedules,  and  the  Department  of  Transportation’s 
list  of  hazardous  materials.  The  list  specifies  the  amount  of  each  chemical  that 
triggers  the  reporting  requirement.  For  some  chemicals,  possession  of  any  amount 
of  the  chemical  would  trigger  the  reporting  requirement. 


13  Id.  at  17730. 

14  Id. 
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Depending  on  what  chemical  substances  the  DHS  Secretary  determines  are 
potentially  dangerous,  the  initial  universe  of  screened  chemical  facilities  may  be 
small  or  large.15  While  many,  if  not  most,  of  these  facilities  would  not  be  high-risk, 
DHS  will  require  all  of  these  chemical  facilities  to  complete  a  consequence-based 
screening  questionnaire  to  determine  their  risk  category.16  The  DHS  will  treat 
facilities  not  completing  such  a  questionnaire  as  presumptively  high-risk.17  Such  an 
approach  may  tax  DHS  resources,  as  well  as  negatively  impact  small  businesses, 
especially  during  the  initial  screening  process.  Retail  propane  dealers,  for  example, 
have  asserted  that  they  would  be  adversely  affected  by  the  proposed  threshold.18 
Since  the  reporting  requirement  depends  on  the  amount  of  chemical  of  interest  held 
at  a  chemical  facility,  not  the  amount  of  chemical  of  interest  in  a  particular  storage 
vessel,  facilities  that  have  large  numbers  of  small  containers  of  a  chemical  of  interest 
may  be  required  to  report.  Some  universities  and  colleges,  not  typically  considered 
as  a  chemical  facility,  have  asserted  that,  because  of  the  low  threshold  for  some 
chemicals  of  interest,  they  are  likely  to  have  to  report  to  DHS  as  a  chemical  facility.19 
Additionally,  depending  on  how  DHS  publicizes  chemical  substance  and  quantity 
requirements,  chemical  facilities  may  not  know  whether  they  are  required  to  report 
under  the  interim  final  rule. 

The  Department  estimates  that  between  1,500  and  6,500  facilities  will  be 
covered  by  risk-based  performance  measure  requirements.  Such  facilities  would 
have  completed  the  initial  screening  process  and  been  categorized  as  falling  within 
one  of  the  four  regulated  risk  tiers.20 


15  For  example,  the  list  of  hazardous  materials  in  the  Department  of  Transportation’s 
Hazardous  Materials  Regulations  (49  CFR  172.101)  is  roughly  160  pages  long.  Also,  the 
universe  of  the  Environmental  Protection  Agency’ s  Risk  Management  Program,  a  program 
based  on  one  of  the  lists  cited  in  the  preamble,  is  approximately  15,000  facilities.  Some  of 
these  facilities  would  fall  within  the  statutory  exemptions  to  chemical  security  regulation, 
such  as  water  or  wastewater  treatment  facilities. 

16  In  2005,  DHS  testified  that  approximately  3,400  chemical  facilities  were  considered  high- 
risk,  having  the  ability  to  impact  1,000  or  more  people.  Testimony  of  Robert  B.  Stephan, 
Assistant  Secretary  for  Infrastructure  Protection,  Department  of  Homeland  Security,  before 
the  Senate  Committee  on  Homeland  Security  and  Governmental  Affairs  on  June  15,  2005. 
The  use  of  a  consequence  threshold  as  an  approximation  of  risk,  as  is  used  in  the  initial 
screening  procedure,  would  likely  capture  all  high-risk  facilities  if  the  consequence 
threshold  was  set  at  a  low  level.  That  tactic  might  also  capture  many  non-high-risk  facilities 
though. 

17  72  Federal  Register  17688-17745  (April  9,  2007)  at  17731. 

18  Linda  Roeder,  “Security  Homeland  Security  Rule  Provisions  Spur  Criticism  Over 
Chemical  Thresholds,”  Daily  Environment  Report ,  June  4,  2007. 

19  Kelly  Field,  “Chemical-Security  Rules  Could  Pose  Huge  Burden  for  Colleges,  Critics 
Say,”  Chronicle  of  Higher  Education  Daily  News,  June  5,  2007. 

20  72  Federal  Register  17688-17745  (April  9,  2007)  at  17723. 
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Inherently  Safer  Technology 

Considerable  congressional  debate  on  chemical  facility  security  revolved  around 
the  issue  of  inherently  safer  technology.  During  this  debate,  the  application  of 
inherently  safer  technology  as  a  risk-reducing  security  measure  was  generally 
supported  by  environmental  groups  and  opposed  by  industry  groups.  Environmental 
groups  proposed  that  reducing  the  inherent  consequences  from  a  release  at  a  chemical 
facility  would  increase  its  security,  as  the  incentive  to  attack  such  a  lower- 
consequence  facility  would  be  reduced.  Industry  groups  argued  that  chemical 
substance  and  technology  changes  were  business  and  process  safety  concerns,  not 
related  to  security  issues,  and  best  left  to  the  discretion  of  the  chemical  facility,  rather 
than  the  federal  government. 

Both  the  statute  and  the  interim  final  rule  are  silent  on  the  issue  of  inherently 
safer  technology.  Neither  recommend  nor  prohibit  the  use  of  inherently  safer 
technology  as  a  security  method,  assuming  that  it  contributes  to  meeting  the  risk- 
based  performance  standards  put  forth  by  DHS.  The  risk-based  performance 
standards  appear  more  focused  on  hardening  facilities  than  on  consequence 
mitigation  techniques.  Alternatively,  use  of  inherently  safer  technology  may  reduce 
the  quantity  or  type  of  chemical  stored  on  site,  possibly  removing  the  chemical 
facility  from  regulation.  Both  the  statute  and  the  interim  final  rule,  in  establishing 
risk-based  performance  standards,  expressly  deny  requiring  any  specific  security 
measure  from  chemical  facilities. 

Federal  Preemption 

Another  area  of  congressional  debate  was  whether  federal  chemical  facility 
security  legislation  should  preempt  such  activities  on  the  state  level.21  Several  states 
have  begun  to  enact  security  regulations  for  chemical  facilities.22  Supporters  of 
explicit  federal  preemption  assert  that  a  patchwork  of  state  regulation  provides  a 
competitive  disadvantage  to  companies  on  a  state-by-state  basis  and  may  lead  to 
uneven  security  efforts.  Opponents  of  explicit  federal  preemption  claim  that  federal 
security  regulation  should  set  a  floor,  rather  than  a  ceiling,  for  security  efforts; 
individual  states  should,  in  their  opinion,  be  allowed  to  require  additional  security 
measures,  so  long  as  the  federal  standard  is  surpassed. 


21  See  Cong.  Rec.  H7968-69  (daily  ed.  September  29,  2006)  (statement  of  Rep.  Barton) 
(stating  that  “[djuring  negotiations  it  was  discussed  and  consciously  decided  among  the 
authorizing  committee  negotiators  to  not  include  a  provision  exempting  this  section  from 
Federal  preemption  because  we  do  not  want  a  patchwork  of  chemical  facilities  that  are 
trying  to  secure  themselves  against  threats  of  terrorism  caught  in  a  bind  of  wondering 
whether  their  site  security  complies  with  all  law.”).  See  also  Cong.  Rec.  H7967  (daily  ed. 
September  29,  2006)  (statement  of  Rep.  King)  (noting  that  the  intent  of  the  committee  was 
not  to  preempt  state  authority  in  adopting  requirements  more  stringent  than  federal  standards 
and  concluding  that  “...it  is  our  understanding,  and  we  had  the  opinion  of  committee  counsel 
on  this,  that  [the  bill  language]  does  not  preempt  States.”) 

22  New  Jersey,  arguably  the  state  with  the  most  stringent  chemical  security  regulations, 
requires  the  consideration  of  inherently  safer  technology  as  a  component  of  a  facility’s 
security  plan. 
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The  statute  is  silent  with  respect  to  preemption;  however,  the  interim  final  rule 
contains  language  indicating  that  DHS  reserves  the  authority  to  preempt  conflicting 
state  requirements.  According  to  DHS,  the  balance  struck  by  P.L.  109-295  between 
DHS  security  requirements  and  a  facility’s  flexibility  to  choose  specific  security 
measures  must  be  preserved.23  The  interim  final  rule’s  explanatory  statement 
distinguishes,  consistent  with  federal  case  law,  between  “field  preemption”  and 
“conflict  preemption,”  asserting  that  the  Department  intends  only  the  latter  to  apply 
to  chemical  security  regulations.24  As  an  example,  DHS  notes  that  Congress’s 
delegation  of  authority  extends  only  to  those  facilities  that  pose  “high  levels  of 
security  risk;”  thus,  according  to  DHS,  the  states  remain  free  to  regulate  any  facility 
that  DHS  has  determined  not  to  be  encompassed  by  this  classification.25 

According  to  the  statute,  “the  Secretary  may  not  disapprove  a  Site  Security  Plan 
submitted  under  this  section  based  on  the  presence  or  absence  of  a  particular  security 
measure.”26  The  federal  chemical  facility  security  regulation  thus  does  not  require 
the  application  or  use  of  any  particular  security  measure.  The  interim  final  rule  then 
seems  to  imply  that  any  state  regulation  that  does  require  a  specific  security  measure 
would  be  preempted,  because  it  “conflicts  with,  hinders,  poses  an  obstacle  to  or 
frustrates  the  purposes  of  these  regulations  or  of  any  approval,  disapproval  or  order 
issued  thereunder.”27 

Although  DHS  has  indicated  that  it  has  not  reviewed  all  existing  state 
regulations  for  preemption  purposes,  they  assert  that  these  existing  state  regulations 
are  unlikely  to  be  preempted  by  the  interim  final  rule.  Future  state  regulations, 
however,  may  be  found  to  be  preempted.  It  seems  likely  that  prescriptive  state 
regulations  would  be  interpreted  by  DHS  as  preempted  by  the  performance-based 
federal  regulation.28 

Information  Availability 

Another  issue  that  generated  considerable  congressional  interest  and  debate  was 
how,  and  to  what  extent,  the  information  created  by  chemical  facilities  and  submitted 
to  DHS  is  to  be  protected  from  disclosure  to  the  public,  industry  competitors,  and 
potential  bad  actors.  The  Freedom  of  Information  Act  (FOIA),  which  generally 


23  72  Federal  Register  17688-17745  (April  9,  2007)  at  17727. 

24  72  Federal  Register  17688-17745  (April  9,  2007)  at  17727  (stating  that  “[DHS]  does  not 
view  its  regulatory  scheme  as  one  which  so  fully  occupies  the  field  as  to  preempt  any  state 
law  touching  the  same  subject.”). 

25  72  Federal  Register  17688-17745  (April  9,  2007)  at  17727. 

26  DHS  Appropriations  Act,  supra  note  1  at  §  550(a). 

27  72  Federal  Register  17688-17745  (April  9,  2007)  at  17739. 

28  For  a  legal  analysis  of  preemption  and  a  discussion  of  DHS’s  authority  to  preempt  state 
law  by  administrative  action,  see  CRS  Congressional  Distribution  Memorandum,  Legal 
Analysis  of  the  Preemption  Provisions  in  the  Recent  Department  of  Homeland  Security’s 
Chemical  Facility  Security  Advance  Notice  of  Rulemaking,  by  Todd  B.  Tatelman  (January 
23,  2007)  (available  from  author  upon  request). 
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applies  to  records  held  by  agencies  of  the  executive  branch  of  the  federal 
government,  regulates  the  disclosure  of  government  information.29  The  FOIA 
requires  agencies  to  publish  in  the  Federal  Register  certain  records,  and  to  make 
other  records  available  for  public  inspection  and  copying.30 

While  the  FOIA  contains  three  specific  law  enforcement  related  exclusions  and 
nine  exemptions  that  permit  the  withholding  of  certain  government-held  information, 
it  has  been  the  prevailing  view  since  September  11,  2001,  that  separate  federal 
statutes  prohibiting  the  disclosure  of  certain  types  of  information,  and  authorizing  its 
withholding  under  the  FOIA,  are  necessary.  As  a  result,  several  security-related 
information  protection  statutes  have  been  enacted  by  Congress  and  implemented  by 
the  government.  Of  specific  relevance  to  chemical  facilities  is  the  protection  regime 
known  as  “Sensitive  Security  Information”  (SSI),  currently  used  by  the 
Transportation  Security  Administration  in  enforcing  the  Maritime  Transportation 
Security  Act  of  2002  (MTSA).31 

Section  550(c)  of  P.L.  109-295  contains  two  specific  mandates  regarding 
information  protection.  The  first  mandate  requires  that 

information  developed  under  this  section,  including  vulnerability  assessments, 
site  security  plans,  and  other  security  related  information,  records,  and 
documents  shall  be  given  protections  from  public  disclosure  consistent  with 
similar  information  developed  by  chemical  facilities  subject  to  regulation  under 
[MTSA].32 

The  reference  to  MTSA  is  considered  to  be  a  reference  to  SSI,  which  is  the 
information  protection  regime  developed  and  administered  by  the  Transportation 
Security  Administration,  and  applicable  to  maritime  facilities  regulated  under  MTSA. 

The  DHS’s  interim  final  chemical  facility  security  regulations  expressly 
recognize  the  reference  to  SSI;  however,  instead  of  amending  the  existing  SSI 
regulations  to  include  application  to  chemical  facilities,  DHS  has  implemented  a  new 
security- information  protection  regime,  “Chemical-terrorism  Vulnerability 
Information”  (CVI).33 


29  5  U.S.C.  §  552  et  seq.  (2000).  For  an  overview  of  FOIA,  see  CRS  Report  RL32780, 
Freedom  of  Information  Act  (FOIA)  Amendmen  ts:  110th  Congress,  by  Harold  C.  Relyea. 

30  See  id.  at  §  552(a)(l)-(2). 

31  While  initially  created  for  the  Department  of  Transportation  in  1974,  SSI  has  been 
significantly  expanded  by  the  Aviation  Transportation  Security  Act  of  2001  (ATSA),  the 
Homeland  Security  Act  of  2002,  and  the  Maritime  Transportation  Security  Act  of  2002.  See 
CRS  Report  RL33670,  Protection  of  Security-Related  Information,  by  Gina  Marie  Stevens 
and  Todd  B.  Tatelman  (providing  an  in-depth  discussion  of  the  history,  requirements,  and 
litigation  that  has  developed  under  SSI). 

32  DHS  Appropriations  Act,  supra  note  1  at  §  550(c). 

33  72  Federal  Register  17688-17745  (April  9,  2007)  at  17727-17739. 
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The  interim  final  rule  provides  that  the  following  types  of  information  will 
constitute  CVI:  (1)  vulnerability  assessments;  (2)  site  security  plans;  (3)  any 
documents  developed  relating  to  the  Department’s  review  and  approval  of 
vulnerability  assessments  and  security  plans;  (4)  alternate  security  plans;  (5) 
documents  relating  to  inspection  or  audits;  (6)  any  records  required  to  be  created  or 
retained  under  these  regulations;  (7)  sensitive  portions  of  orders,  notices  or  letters 
(8)  information  developed  to  determine  the  risk  posed  by  chemical  facilities,  or  to 
determine  which  facilities  are  “high  risk;”  and  (9)  any  other  information  that  the 
Secretary,  in  his  discretion,  determines  warrants  the  protections  set  forth  in  this  part.34 

The  interim  final  rule  states  that  “covered  persons”  must  “[d]isclose,  or 
otherwise  provide  access  to,  CVI  only  to  covered  persons  who  have  a  need  to 
know.”35  The  term  “covered  persons”  is  defined  by  the  proposed  rules  as:  persons 
who  have  a  need  to  know  CVI  and  as  persons  who  otherwise  receive  access  to  “what 
they  know  or  reasonably  should  know  constitutes  CVI.”36  According  to  the  interim 
final  rule,  persons  with  the  “need  to  know,”  which  expressly  includes  state  and  local 
officials,  are  categorized  in  five  ways:  (1)  persons  who  require  access  to  carry  out 
activities  approved  or  sanctioned  by  DHS;  (2)  persons  who  require  access  to  train  for 
DHS  approved  or  sanctioned  activities;  (3)  persons  required  to  supervise,  manage, 
or  otherwise  oversee  DHS  approved  or  sanctioned  activities;  (4)  persons  who  require 
the  information  for  the  purposes  of  providing  technical  or  legal  advice;  and  (5) 
persons  who  are  representing  a  covered  person  in  either  an  administrative  or  judicial 
proceeding.37 

The  interim  final  rule  indicates  that  DHS  may  “make  an  individual’s  access  to 
the  CVI  contingent  upon  satisfactory  completion  of  a  security  background  check  or 
other  procedures  or  requirements  for  safeguarding  CVI  that  are  satisfactory  to 
DHS.”38  Finally,  the  interim  final  rule  provides  DHS  with  discretionary  authority  to 
further  limit  access  to  CVI,  even  if  persons  otherwise  meet  the  required 
qualifications.  The  regulations  state  that  “[f]or  some  specific  CVI,  DHS  may  make 
a  finding  that  only  specific  persons  or  classes  of  persons  have  a  need  to  know.”39  It 
is  unclear  from  this  language  in  what  circumstances,  or  by  what  standards,  DHS  will 
issue  such  findings. 

The  second  mandate  contained  in  P.L.  109-295  states  that: 

in  any  proceeding  to  enforce  this  section,  vulnerability  assessments,  site  security 

plans,  and  other  information  submitted  to  or  obtained  by  the  Secretary  under  this 


34  72  Federal  Register  17688-17745  (April  9,  2007)  at  17737. 

35  Id. 

36  Id. 

37  Id.  at  17738. 

38  Id. 

39  Id. 
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section,  and  related  vulnerability  or  security  information,  shall  be  treated  as  if  the 

information  were  classified  material.40 

The  terms  “classified  material'’  or  “classified  information”  have  been  defined  in 
several  different  contexts.  Congress  has  statutorily  defined  “classified  material”  as 
“[a]ny  information  or  material  that  has  been  determined  by  the  United  States 
government  pursuant  to  an  Executive  Order,  statute,  or  regulation,  to  require 
protection  against  unauthorized  disclosure  for  reasons  of  national  security....”41 
Executive  Orders  have  defined  “classified  information”  as  “information  that  ... 
require[s]  protection  against  unauthorized  disclosure  and  is  marked  to  indicate  its 
classified  status  when  in  documentary  form.”42  In  addition,  according  to  Executive 
Order,  “classified  information”  may  include  anything  that  the  original  classifying 
authority  determines  that  “reasonably  could  be  expected  to  result  in  damage  to 
national  security,  which  include[s]  defense  against  transnational  terrorism,  and  the 
original  classification  authority  is  able  to  identify  and  describe  the  damage.”43 

As  a  result  of  this  congressional  mandate  and  the  nature  of  the  information  at 
issue,  DHS  has  indicated  that  in  administrative  proceedings  and  litigation  before 
courts,  CVI  will  only  be  disclosed  under  the  narrowest  of  parameters  consistent  with 
Executive  Orders  and  other  congressional  enactments.  In  administrative  proceedings, 
DHS  indicates  that  CVI  will  only  be  disclosed  at  the  Secretary’s  sole  discretion  and 
only  when  it  “is  necessary  for  the  person  to  prepare  a  response  to  allegations 
contained  in  a  legal  enforcement  action  document  issued  by  the  Department.”44  Even 
in  such  a  circumstance,  DHS  reserves  the  right  to  require  the  requesting  person  or 
entity  to  undergo  and  satisfy  a  security  background  check  before  receiving  the 
information.45 

Similarly,  in  litigation  arising  out  of  enforcement  actions,  whether  civil  or 
criminal,  DHS  has  implemented  a  system  of  applicable  procedures  akin  to  those 
contained  in  both  the  Classified  Information  Protection  Act,46  and  at  18  U.S.C.  § 
2339B.  For  example,  DHS  will  permit  reviewing  courts,  after  an  opportunity  to 
independently  view  the  documents,  to  authorize  one  of  the  following  as  a  substitute 
for  CVI  sought  in  discovery:  (1)  A  redacted  version  of  the  CVI  documents;  (2)  a 
summary  of  the  information  contained  in  the  CVI  documents;  or  (3)  a  statement 
admitting  relevant  facts  that  the  CVI  documents  would  tend  to  prove.47  The  interim 
final  rule  also  provides  protections  against  the  disclosure  of  CVI  through  live  witness 


40  DHS  Appropriations  Act,  supra  note  1  at  §  550(c). 

41  Classified  Information  Procedures  Act,  P.L.  96-456,  94  Stat.  2025  (1980)  (codified  as 
amended  at  18  U.S.C.  App.  3  §§  1-16  (2000))  [hereinafter  CIPA], 

42  Exec.  Order  No.  12958  §  6.1(h),  60  Federal  Register  19825  (April  20,  1995). 

43  Exec.  Order  No.  13292  §  1.1(a)(4),  68  Federal  Register  15315  (March  28,  2003). 

44  72  Federal  Register  17688-17745  (April  9,  2007)  at  17738. 

45  Id. 

46  See  CIPA,  supra  note  36. 

47  72  Federal  Register  17688-17745  (April  9,  2007)  at  17738-17739. 
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testimony.48  Moreover,  in  the  event  that  the  Government  objects  to  a  witness’s 
testimony,  the  regulations  authorize  the  court  to  consider  an  ex  parte  proffer  by  the 
Government  on  what  the  witness  is  likely  to  say,  as  well  as  a  proffer  from  the 
defendant  of  the  nature  of  the  information  sought.49  Further,  the  interim  final  rule 
permits  the  Department  to  immediately  appeal  if  a  court  denies  any  request  related 
to  the  disclosure  of  CVI.50  Finally,  the  interim  final  rule  expressly  states  that  no  CVI 
will  be  provided  in  any  civil  litigation  unrelated  to  the  enforcement  of  Section  550. 51 

Expiration  of  Regulations  and  Authority 

The  meaning  of  the  expiration  provision  of  P.L.  109-295  appears  to  be  the 
subject  of  some  uncertainty.  The  statute  specifically  states  that: 

Interim  regulations  issued  under  this  section  shall  apply  until  the  effective  date 
of  interim  or  final  regulations  promulgated  under  other  laws  that  establish 
requirements  and  standards  referred  to  in  subsection  (a)  and  expressly  supercede 
this  section.  Provided,  [t]hat  the  authority  provided  by  this  section  shall 
terminate  three  years  after  the  date  of  enactment  of  this  Act.52 

In  the  preamble  to  DHS’s  proposed  regulations  the  Department  suggests  that 
notwithstanding  the  plain  text  of  the  statute,  should  future  funds  be  appropriated  by 
Congress,  even  in  the  absence  of  an  authorizing  statute,  the  regulations  and  the 
authority  to  enforce  them  would  continue  as  though  sufficiently  authorized.53 

As  a  general  rule,  there  is  no  specific  statutory  or  other  legal  requirements  that 
appropriations  be  preceded  by  specific  authorizations.  As  a  result,  Congress  may, 
subject  to  possible  procedural  points  of  order,54  appropriate  funds  for  programs  that 
exceed  the  scope  and/or  duration  of  a  prior  authorization.  In  instances  where 
Congress  has  opted  for  this  type  of  action,  the  enacted  appropriation  has  been 
interpreted  by  the  Comptroller  General  to,  in  effect,  carry  with  it  its  own 
authorization  and,  therefore,  is  to  be  available  to  the  agency  for  obligation  and 


48  Id. 

49  Id. 

50  Id. 

51  Id. 

52  DHS  Appropriations  Act,  supra  note  1  at  §  550(b). 

53  See  71  Federal  Register  78276-78332  (December  28,  2006)  at  78276  and  78281  (stating 
that  “[i]f  a  future  appropriations  bill  continued  funding  for  the  Section  550  program  beyond 
that  period,  the  Department  could  consider  that  future  funding  for  the  program  as  an 
extension  of  the  ‘authority  provided  by  this  section.’”). 

54  Rule  XXI(2)  of  the  Rules  of  the  House  of  Representatives  prohibits  appropriations  for 
objects  not  previously  authorized  by  law.  A  similar,  but  more  limited,  prohibition  exists  in 
Rule  XVI  of  the  Standing  Rules  of  the  Senate.  Each  of  these  provisions  must  be  raised  via 
a  “point  of  order,”  which  may  be  overcome  by  a  super-majority  vote  in  each  chamber. 
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expenditure.55  In  addition,  the  Comptroller  General  has  also  held  that,  as  a  general 
proposition,  the  appropriation  of  funds  for  a  program  whose  funding  authorization 
has  expired,  or  is  about  to  expire  during  the  period  of  availability  of  the  appropriation 
(e.g.,  authorization  expires  during  a  fiscal  year  for  which  money  has  already  been 
appropriated),  provides  sufficient  legal  basis  to  continue  a  program  during  that  period 
of  availability,  even  when  expressed  congressional  intent  appears  to  be  contrary.56 
Given  these  general  rules,  it  would  appear  that  should  Congress  appropriate  funds  to 
DHS  for  the  purpose  of  continuing  to  secure  chemical  facilities,  even  after  the 
expiration  of  the  Section  550  authorization,  sufficient  legal  authority  would  exist  for 
the  regulations  to  remain  in  effect. 


Policy  Options 

Reaction  to  the  proposed  regulation  and  the  interim  final  rule  has  been  mixed. 
Some  policymakers  and  advocates  have  criticized  the  approach  taken  by  DHS. 
Others  have  been  supportive.  As  written,  the  law  anticipates  further  legislative 
activity  in  this  area.  Policymakers  may  decide  to  wait  and  observe  how  the  final 
interim  rule  is  implemented,  attempt  to  influence  DHS’s  implementation  of  the 
interim  final  rule,  or  legislate  to  alter  or  supersede  the  enacted  legislation. 

Maintain  Status  Quo 

The  authority  to  federally  regulate  chemical  facility  security  is  new.  As  such, 
regulation  in  this  area  may  need  time  to  mature.  Congress,  when  passing  P.L.  109- 
295,  contemplated  the  eventual  supersession  of  these  regulations: 

Interim  regulations  issued  under  this  section  shall  apply  until  the  effective  date 
of  interim  or  final  regulations  promulgated  under  other  laws  that  establish 
requirements  and  standards  referred  to  in  subsection  (a)  and  expressly  supersede 
this  section:  Provided,  [t]hat  the  authority  provided  by  this  section  shall 
terminate  three  years  after  the  date  of  enactment  of  this  Act.57 

Policymakers  may  view  this  regulatory  authority,  and  thus  these  regulations,  as  a 
stop-gap  measure,  providing  a  temporary  solution  to  the  perceived  chemical  security 
problem,  with  the  intent  of  allowing  the  security  policy  debate  to  further  mature.  In 
this  case,  policymakers  may  decide  to  wait,  allowing  DHS  to  implement  its  interim 
final  rule  before  considering  changes  in  chemical  facility  security  policy.  This  might 
more  fully  reveal  the  impacts  of  the  current  regulation. 


55  See  67  Comp.  Gen.  401  (1988). 

56  See,  e.g.,  65  Comp.  Gen.  524  (1986);  65  Comp.  Gen.  318,  320-21  (1986);  55  Comp.  Gen. 
289(1975). 

57  DHS  Appropriations  Act,  supra  note  1  at  §  550. 
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Attempt  to  Influence  Implementation 

The  statutory  language  of  P.L.  109-295,  Section  550  grants  significant  discretion 
to  the  DHS  Secretary.  The  interpretation  and  application  of  this  discretion  by  the 
DHS  Secretary,  particularly  in  the  areas  of  information  protection  and  state 
preemption,  were  the  source  of  some  of  the  criticisms  levied  against  the  proposed 
regulations.58  While  discretionary  authority  may  be  important  to  the  effective  and 
efficient  implementation  of  a  regulatory  structure,  policymakers  may  believe  that 
execution  of  this  discretionary  authority  has  been  counter  to  congressional  intent. 
Policymakers  may  decide  to  influence  the  manner  in  which  the  DHS  Secretary’s 
discretion  is  applied. 

The  DHS  requested  public  comment  from  interested  parties  on  questions,  issues, 
and  the  proposed  regulatory  language.59  As  such,  the  comments  of  policymakers, 
advocates  and  interested  parties  influenced  the  form  and  language  of  the  interim  final 
rule.  Through  comments  to  the  docket,  policymakers  expressed  support  for  and 
criticism  of  the  proposed  regulations.60  The  docket  for  the  proposed  regulation 
closed  on  February  7,  2007.  The  interim  final  rule,  promulgated  on  April  9,  2007, 
took  account  of  these  comments,  addressing  them  as  the  Department  deemed 
appropriate. 

Policymakers  may  conclude  that  they  are  dissatisfied  with  the  form  of  the 
interim  final  rule.  If  this  is  the  case,  policymakers  could  act  to  more  explicitly 
describe  and  limit  the  discretionary  scope  granted  to  the  DHS  Secretary.  They  may 
influence  the  interim  final  rule’s  implementation  through  the  congressional  oversight 
process  by  clarifying  congressional  intent,  through  hearings  on  the  interim  final  rule’ s 
implementation,  or  through  language  added  to  DHS  appropriations  legislation  and 
reports. 

Another  option  would  be  for  Congress  to  invoke  the  Congressional  Review  Act 
(CRA).61  The  CRA  establishes  an  expedited  mechanism  by  which  Congress  can 
review  and  disapprove  final  federal  agency  rules.62  Since  its  enactment,  however,  the 
CRA  has  been  successfully  used  only  once.  If  the  interim  final  rule  is  successfully 
disapproved  under  the  CRA,  DHS  would  be  prohibited  from  promulgating  a  similar 
rule  absent  an  express  authorization  from  Congress. 


58  John  Heilprin,  “Chemical  Plants  to  Submit  Security  Plans,”  Associated  Press,  December 
22,  2006;  Greg  Gordon,  “New  Rules  Aim  to  Protect  Chemical  Plants  from  Terrorists,”  San 
Jose  Mercury  News,  December  22,  2006. 

59  71  Federal  Register  78276-78332  (December  28,  2006)  at  78277.  An  electronic  docket 
for  this  proposed  regulation  was  established  at  [http://www.regulations.gov]  under  docket 
identification  number  DHS-2006-0073. 

60  Comments  submitted  to  the  docket  may  be  viewed  online  at  [http://www.regulations.gov] 
under  docket  identification  number  DHS-2006-0073. 

61  Small  Business  Regulatory  Enforcement  Fairness  Act  of  1996,  P.L.  104-121. 

62  See  CRS  Report  RL31 160,  Disapproval  of  Regulations  by  Congress:  Procedure  Under 
the  Congressional  Review  Act,  by  Richard  S.  Beth. 
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Legislative  Alternatives 

Policymakers  may  decide  that  additional  legislation  is  necessary  in  the  chemical 
facility  security  area.  Such  legislation  could  be  targeted  in  nature,  attempting  to 
remedy  perceived  flaws  by  slightly  altering  the  existing  authorities  granted  to  DHS, 
or  more  comprehensive.  A  more  comprehensive  approach  may  occasion  substantive 
changes  in  the  existing  authorities  and  thus  extensive  revision  of  any  chemical 
facility  security  regulation. 

Policymakers  may  ultimately  decide  that  the  regulatory  structure  established  by 
DHS  does  not  satisfy  homeland  security  needs  or  will  prove  too  onerous  to  industry 
and  opt  to  enact  new  chemical  facility  legislation.  Such  legislation  might  expand  the 
reach  of  the  regulatory  structure,  for  example,  by  mandating  the  inclusion  of 
particular  chemical  substances  as  potentially  dangerous;  restrict  the  scope  of 
regulation,  for  example,  by  lowering  regulatory  burdens  or  requirements  on  small 
businesses;  or  direct  the  agency  to  include  or  exclude  particular  components  from  its 
regulations. 

Developing  new  legislation,  or  changing  existing  legislation,  to  alter  the  DHS 
interim  final  rule  may  bring  additional  costs,  especially  to  facilities  that  have  already 
come  into  compliance.  If  new  regulations,  established  under  new  or  amended 
authority,  present  new  requirements  for  chemical  facilities,  security  efforts  enacted 
under  the  original  interim  final  rule  may  not  be  entirely  applicable.  Chemical 
facilities  may  be  required  to  invest  in  additional  security  measures  to  meet  these  new 
requirements,  potentially  incurring  further  cost.  When  considering  whether  to  enact 
new  legislation  or  amend  existing  law,  policymakers  may  opt  to  consider  methods 
to  mitigate  additional  costs  to  chemical  facilities  that  have  already  complied  with  the 
interim  final  rule.  Considering  the  initial  statute  had  a  three-year  sunset  provision, 
Congress  may  have  intended  that  future  legislation  build  upon  P.L.  109-295,  Section 
550,  so  that  future  regulations  would  be  harmonized  with  the  interim  final  rule 
initially  promulgated. 

Legislation  in  the  1 10th  Congress.  Legislative  efforts  are  under  way  in  the 
110th  Congress  to  alter  DHS’s  statutory  authority  to  regulate  chemical  facilities. 
Three  freestanding  bills  have  been  introduced  in  the  House  of  Representatives  and 
chemical  facility  security  provisions  were  included  in  the  vetoed  FY2007 
supplemental  appropriation  bill  (H.R.  1591). 

The  Safe  Facilities  Act  (H.R.  1574)  would  attempt  to  preserve  state  chemical 
facility  security  authority  by  preventing  federal  preemption  of  state  chemical  facility 
security  laws  and  regulations  that  are  more  stringent  than  the  federal  standard.  H.R. 
1633  would  attempt  to  preserve  state  chemical  facility  security  authority  by 
prohibiting  the  Secretary  from  promulgating  chemical  facility  security  regulations 
that  preempt  more  stringent  state  chemical  facility  security  regulations. 

The  Chemical  Facility  Security  Improvement  Act  of  2007  (H.R.  1530)  also 
would  attempt  to  preserve  state  chemical  facility  security  laws  and  regulations,  but 
it  contains  additional  provisions.  It  would  limit  the  chemical  facility  security 
information  protected  from  disclosure  to  vulnerability  assessments  and  site  security 
plans.  Chemical  facility  security  information  would  be  treated  in  judicial 
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proceedings  as  Sensitive  Security  Information  (SSI),  rather  than  as  classified 
material.63  It  would  allow  the  Secretary  to  disapprove  a  site  security  plan  based  on 
the  presence  or  absence  of  a  particular  security  measure.  Finally,  it  would  grant 
others  besides  the  Secretary  a  right  of  legal  action  to  enforce  security  provisions. 

The  Department  of  Homeland  Security  Appropriations  Act,  2008  (H.R.  2638) 
would  attempt  to  preserve  state  chemical  facility  security  laws  and  regulations  by 
preventing  federal  preemption  of  state  chemical  facility  security  regulations  that  are 
more  stringent  than  the  federal  standard.  It  would  also  limit  the  chemical  security 
information  protected  and  treat  protected  information  as  SSI.  H.R.  2638  passed  the 
House  of  Representatives  on  June  15,  2007. 

The  Department  of  Homeland  Security  Appropriations  Act,  2008  (S.  1644) 
would  attempt  to  preserve  state  chemical  facility  security  laws  and  regulations  by 
preventing  federal  preemption  of  state  chemical  facility  security  regulations  that  are 
more  stringent  than  the  federal  standard.  Only  in  the  case  of  actual  conflict  would 
state  law  be  preempted.  S.  1644  was  reported  out  of  the  Senate  Committee  on 
Appropriations  on  June  18,  2007. 

Chemical  facility  security  provisions  were  included  in  the  vetoed  FY2007 
supplemental  appropriations  bill.  The  chemical  facility  security  provisions  of  the 
U.S.  Troop  Readiness,  Veterans’  Health,  and  Iraq  Accountability  Act,  2007  (H.R. 
1591)  would  have  attempted  to  preserve  state  chemical  facility  security  laws  and 
regulations;  limited  the  scope  of  information  protected  as  chemical  security 
information;  and  treated  protected  information  as  SSI. 


63  See  CRS  Report  RL33670,  Protection  of  Security-Related  Information,  by  Gina  Marie 
Stevens  and  Todd  B.  Tatelman  (providing  an  in-depth  discussion  of  the  history, 
requirements,  and  litigation  that  has  developed  under  SSI). 


